AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Effective routes on NIC vm-app01: Address prefix Next hop type Source 10.20.0.0/16 Virtual network System 10.30.0.0/16 Virtual network gateway BGP 0.0.0.0/0 Virtual appliance User The VM is in 10.20.0.0/16 and is connected to a VPN gateway that advertises 10.30.0.0/16.
Based on the exhibit, what next hop will the VM use when it sends traffic to 10.30.5.10?
⚠ Common exam trap
It's easy for candidates to assume traffic to an IP within the virtual network's address space (10.0.0.0/16) will always use the 'Virtual network' next hop, but a more specific route (e.g., 10.30.5.0/24) with a different next hop type overrides it, leading to an incorrect choice of Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual network gateway
The VM's effective route table shows a route for 10.30.5.0/24 with a next hop type of 'Virtual network gateway'. Since 10.30.5.10 falls within this prefix, the VM will use the virtual network gateway as the next hop. This overrides the default virtual network (local) route because it is a more specific prefix match.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Virtual appliance at the user-defined next hop
Why it's wrong here
A user-defined route with next hop of a virtual appliance typically installs a default route (0.0.0.0/0) for forced tunneling or NVA inspection. However, the destination 10.30.5.10 is inside 10.30.0.0/16, and the BGP route for that /16 is a longer prefix match. Azure always prefers the most specific prefix, so the default route via the virtual appliance has a shorter prefix and loses despite the UDR's higher priority for equal prefixes.
When this WOULD be correct
If the question described a scenario where a user-defined route (UDR) is configured for the destination 10.30.5.0/24 with next hop set to 'Virtual appliance', and the VM is in a subnet associated with that route, then the correct answer would be the virtual appliance.
- ✓
Virtual network gateway
Why this is correct
The destination 10.30.5.10 falls within the 10.30.0.0/16 prefix learned over BGP through the virtual network gateway. Azure uses longest-prefix match, and /16 is more specific than the default route (0.0.0.0/0) or the VNet local /16, so the next hop is the virtual network gateway as indicated in the effective route table. No other matching route has a longer or equal prefix, so this route wins.
- ✗
Internet
Why it's wrong here
There is no system or user-defined route that specifically sends 10.30.0.0/16 traffic to the Internet, and Azure's default Internet route applies only to 0.0.0.0/0 when no more specific route exists. Since the BGP-learned 10.30.0.0/16 route is present and covers 10.30.5.10, traffic to that address never falls back to the Internet-facing default route. So the next hop is not the Internet.
When this WOULD be correct
If the destination IP were a public IP address (e.g., 8.8.8.8) and no forced tunneling or specific route existed, the next hop would be 'Internet' as the default route for internet-bound traffic.
- ✗
Virtual network
Why it's wrong here
The Virtual network system route applies only to the address space directly assigned to the VNet where the VM resides, such as 10.20.0.0/16 in the exhibit. The destination 10.30.5.10 is outside that range, so the VNet local route does not match at all. Even though it is a /16, it is the wrong /16, so the more specific BGP route for 10.30.0.0/16 is the only valid path.
When this WOULD be correct
If the question asked for the next hop when a VM sends traffic to another VM in the same virtual network (e.g., 10.30.5.10 is within the VNet address space), the correct answer would be 'Virtual network' because Azure automatically routes within a VNet.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Virtual network gatewayCorrect answer▾
Why this is correct
The destination 10.30.5.10 falls within the 10.30.0.0/16 prefix learned over BGP through the virtual network gateway. Azure uses longest-prefix match, and /16 is more specific than the default route (0.0.0.0/0) or the VNet local /16, so the next hop is the virtual network gateway as indicated in the effective route table. No other matching route has a longer or equal prefix, so this route wins.
✗Virtual appliance at the user-defined next hopWrong answer — click to see why▾
Why this is wrong here
The exhibit shows that the route for 10.30.5.0/24 has a next hop type of 'Virtual network gateway', not 'Virtual appliance'. A user-defined route with a virtual appliance next hop would override the gateway, but no such route is present.
★ When this WOULD be the correct answer
If the question described a scenario where a user-defined route (UDR) is configured for the destination 10.30.5.0/24 with next hop set to 'Virtual appliance', and the VM is in a subnet associated with that route, then the correct answer would be the virtual appliance.
Why candidates choose this
Candidates may confuse user-defined routes (UDR) with system routes, or assume that any traffic to an external IP must go through a virtual appliance for inspection, even when no UDR is configured.
✗InternetWrong answer — click to see why▾
Why this is wrong here
The destination IP 10.30.5.10 is within the virtual network's address space, so traffic is routed internally via the virtual network gateway, not sent to the internet.
★ When this WOULD be the correct answer
If the destination IP were a public IP address (e.g., 8.8.8.8) and no forced tunneling or specific route existed, the next hop would be 'Internet' as the default route for internet-bound traffic.
Why candidates choose this
Candidates may mistakenly assume that any IP not explicitly in a route table goes to the internet, ignoring that 10.30.5.10 is a private IP within the VNet.
✗Virtual networkWrong answer — click to see why▾
Why this is wrong here
The VM's traffic to 10.30.5.10 is destined for an on-premises network connected via VPN/ExpressRoute, and the route table shows the next hop as the virtual network gateway, not the virtual network.
★ When this WOULD be the correct answer
If the question asked for the next hop when a VM sends traffic to another VM in the same virtual network (e.g., 10.30.5.10 is within the VNet address space), the correct answer would be 'Virtual network' because Azure automatically routes within a VNet.
Why candidates choose this
Candidates may confuse the destination IP being within the VNet's address space (if they misread the exhibit) or think that internal traffic always uses the virtual network as the next hop, overlooking the explicit route pointing to the gateway.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
VPN Gateway and ExpressRoute
Key term
Route
A route is a path that data takes through a network from one device or network to another, determined by routing protocols and configured rules.
Key term
Route table
A route table is a set of rules, called routes, that determine where network traffic from a subnet or virtual network is directed.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.